SSL Certificate Checker: Expiry, Issuer, Chain, TLS avatar

SSL Certificate Checker: Expiry, Issuer, Chain, TLS

Pricing

Pay per event

Go to Apify Store
SSL Certificate Checker: Expiry, Issuer, Chain, TLS

SSL Certificate Checker: Expiry, Issuer, Chain, TLS

Check SSL/TLS certificates for any list of domains: days until expiry, issuer, whether it covers the host name, trusted chain, self-signed, TLS version, cipher, key type and all subject alternative names. Great for expiry monitoring on a schedule.

Pricing

Pay per event

Rating

0.0

(0)

Developer

Dodge Sucharda

Dodge Sucharda

Maintained by Community

Actor stats

0

Bookmarked

2

Total users

1

Monthly active users

22 days ago

Last modified

Share

Check the SSL/TLS certificate of any number of domains in one run: expiry date and days left, issuer, whether it covers the host name, whether the chain is trusted, self-signed certificates, TLS version, cipher, key type and every subject alternative name.

$1 per 1,000 hosts. Hosts that do not exist or refuse the connection are free.

Good for

  • Expiry monitoring: schedule it daily or weekly on your domains and alert on daysLeft (use Apify's schedules and integrations)
  • Agencies and IT teams: audit every client site at once
  • Security reviews: find self-signed, mismatched or old-TLS endpoints
  • Inventory: list which certificate authority each domain uses

Output (one row per host; real result from 30 Sep 2026, shortened)

{
"host": "apify.com",
"port": 443,
"status": "ok",
"valid": true,
"daysLeft": 108,
"validTo": "2027-01-16T23:59:59.000Z",
"issuer": "Amazon",
"issuerCommonName": "Amazon RSA 2048 M04",
"coversHost": true,
"trusted": true,
"selfSigned": false,
"protocol": "TLSv1.3",
"keyType": "RSA 2048",
"sanCount": 4,
"subjectAltNames": ["*.apify.com", "apifier.com", "*.apifier.com", "apify.com"],
"issues": []
}

valid is false when there is any error: expired, expiring within 7 days, not yet valid, host name not covered, self-signed, or an untrusted chain. expires_soon (within your warning window, default 30 days) and old TLS versions are warnings.

Input

  • Hosts: domains or URLs, optionally with a port (mail.example.com:993 works for any TLS service).
  • Warn when expiring within (days): default 30.

Limits

  • It reads the certificate the server presents for the host name you give (SNI). It does not scan every server behind a load balancer.
  • It does not check revocation (OCSP/CRL).